SAS® Customer Intelligence 360: Onboarding Guide

Introduction

This documentation covers tasks that account administrators need to perform when they first log on to SAS Customer Intelligence 360. The tasks include setting up CNAMEs, configuring content security policies, adding and managing users, and preparing and loading data. Information about additional documentation and training is also provided.

Step 1: For Hosting on Custom Domains, Set Up CNAMEs to Stop Ad Blockers

Note: This step is required for SAS 360 Engage users who want to stop ad blockers from blocking content from SAS Customer Intelligence 360. This step is recommended for SAS 360 Discover users.

By default, SAS Customer Intelligence 360 delivers personalized content from a SAS domain to your website. Because your browser sees the content as coming from a third party, the content might be blocked. Between 20% and 30% of a country’s users have installed ad blockers that prevent them from receiving personalized content from SAS Customer Intelligence 360. To prevent your personalized offers from being blocked, it is recommended that you set up canonical names (CNAMEs) so that all SAS Customer Intelligence 360 requests occur in your website's domain and are not seen as suspicious. To set up CNAMEs:

1 Inform SAS Technical Support that you are creating CNAMEs for your domain. This action creates a Technical Support ticket that you need to access in Step 4 on page 2.

2 Determine the short names for your tenants. (It is a best practice to set up a tenant for the test environment and a tenant for the production environment.) You need these short names later to determine the endpoints for your CNAMEs. The short names can be found in one of these places:

n in the welcome email for SAS Cloud. The original email is similar to this example:

An account has been created for <tenant short name>, and you have been designated as the primary account administrator. In this role, you are responsible for setting up the account for your organization.

n on the Environments page in AppCentral.

3 Create a canonical name (CNAME) record for each listed domain name in your organization's domain name system (DNS). A CNAME record is a resource record in the domain name system that specifies that the CNAME record represents an alias to the SAS Customer Intelligence 360 domain names.

You need as many as three CNAME records. Here are the recommended name variations for your servers:

TIP It is recommended to include ci360 in the CNAMEs in order to make it easier to debug errors when you use the browser’s developer tools. Also, avoid using ad in any of the CNAMEs because the word might trigger ad-blocking software.

Executionserver that loads the SAS tag and sends events. Your CNAME record should be an alias that is similar to execution-ci360.<customer domain> and points to execution-<tenant short-name>.ci360.sas.com.

Deliveryserver that requests content and customizes the delivery of content on the web pages. Your CNAME record should be an alias that is similar to delivery-ci360.<customer domain> and points to <tenant short-name>-ia.aimatch.com.

(Optional) Contentrequired only when you use the assets manager in SAS Customer Intelligence 360. Otherwise, content for assets must be loaded from your content management system.

Your CNAME record should be an alias that is similar to content-ci360.<customer domain> and points to content.aimatch.com.

4 After you create the CNAMEs, respond to the original Technical Support ticket that you opened in Step 1 on page 1.

5 For all new and renewing certificates, SAS uses the AWS Certificate Manager (ACM), which is a certification authority, to initiate a request for the appropriate customer fully qualified domain names (FQDNs). Because AWS is the certification authority, it generates and signs the certificate for a given subject principal without transmission of a certificate signing request (CSR) between the parties. Consequently, X.509 documents are not exchanged during the process.

SAS Technical Support notifies you that you will receive two separate emails from ACM at Amazon Web Services <replies-disabled@certificates.amazon.com>. These emails prompt you for approval to use the certificate with SAS and contain account numbers that end in -7601 and -5096 for identification.

The emails are sent to the administration contacts listed in the WHOIS record for your root domain. SAS has no control over the addresses of your contacts. You are responsible for keeping your WHOIS registry data current. SAS does not receive a copy of the emails from AWS.

Note: You must approve the certificate request in order for SAS to use the certificates. You have 72 hours to follow the authorization links in the two emails from ACM before they expire and new emails must be sent. You must take action to have another email sent from AWS.

6 Approve the certificate authorization request by following the authorization links in the emails. ACM generates, signs, and stores the certificate and its key on its servers. This certificate is unique and non-transferrable. For security, the certificate cannot be moved to another region, and it cannot be exported from AWS. The private key data is secured and inaccessible to everyone, including SAS, which eliminates the possibility of certificate impersonation.

7 Inform SAS Technical Support that you approved the use of the certificate. SAS does not receive notification from the AWS Certificate Manager.

8 SAS validates that you have created the agreed-upon CNAME records in its domain by performing domain name system (DNS) lookups to determine whether your CNAME records resolve to the correct SAS FQDNs.

9 SAS updates your tenant configuration.

2

10 SAS uses a third-party tool such as Qualys/SSL Labs to validate the TLS capabilities of all endpoints to determine that the installation is correct and to verify that the browser is trusted.

11 SAS Technical Support informs you when everything is operational and you can load the tag from the CNAME that was created under execution (that is, execution-<tenant short-name>.ci360.sas.com>).

TIP If you want the certificate to be revoked, open a Technical Support ticket to request SAS work with AWS to remove the certificate.

Step 2: Configure the Content Security Policies for Your Web Server

Many companies set a Content Security Policy (CSP) on their web server to prevent cross-site scripting, clickjacking, and other code injection attacks that are caused by the execution of malicious content on a trusted web page. CSPs are defined in the web server configuration and transmitted in the http header to specify which items are allowed to be loaded to the website.

If SAS Customer Intelligence 360 is not defined in the content security policy configuration for your company website, these issues might occur:

n Your company website cannot be opened in the SAS Customer Intelligence 360 user interface (iFrame).

n The SAS Customer Intelligence 360 user interface cannot be used to select spots.

n SAS Customer Intelligence 360 cannot collect data or deliver content.

n Explicit error messages about the content security policy appear in the browser console.

If your website does not open in the SAS Customer Intelligence 360 user interface, perform one of these actions:

Note: The browser might perform unpredictably if you use the X-Frame and Content Security Policy options at the same time.

n Configure the X-Frame-Option parameter in the http header that adds the SAS Customer Intelligence 360 user interface address to the ALLOW-FROM list so that it looks like this:

<IfModule mod_headers.c>

Header set X-Frame-Options "sameorigin ALLOW-FROM https://design-<xxx>.ci360.sas.com"

</IfModule>

In the header, xxx is use (if your tenant is hosted in the United States) or euw (if your tenant is hosted in Europe).

Note: The X-Frame-Option parameter is deprecated at a later date. At that time, the browser ignores any existing X-Frame-Option parameter that blocks SAS Customer Intelligence 360.

n Configure the frame-ancestor attribute in the Content-Security-Policy parameter in the http header that adds the SAS Customer Intelligence 360 user interface address to the allowed ancestors so that it looks like this:

Note: The frame-ancestor attribute is equivalent to the X-Frame-Option parameter.

<IfModule mod_headers.c>

3

Header set Content-Security-Policy "frame-ancestors 'self' design-<xxx>.ci360.sas.com"

</IfModule>

In the header, xxx is use (if your tenant is hosted in the United States) or euw (if your tenant is hosted in Europe).

If the page loads in the SAS Customer Intelligence 360 user interface but you cannot select items in the user interface, or you see error messages in the browser console when loading your website, your content security policy is too restrictive. Add the following italicized content to your content security policy to allow the SAS Customer Intelligence 360 script to be loaded and executed so that it can deliver content to your site.

Note: You can also set up CNAMEs so that the SAS Customer Intelligence 360 scripts come from the site’s domain. For more information, see “Step 1: For Hosting on Custom Domains, Set Up CNAMEs to Stop Ad Blockers” on page 1.

Your Content-Security-Policy configuration must look like this:

<IfModule mod_headers.c>

Header set Content-Security-Policy "default-src 'self' data: 'unsafe-inline' 'unsafe-eval'; font-src *.sas.com; script-src 'self' 'unsafe-inline''unsafe-eval'*.ci360.sas.com; connect-src 'self' *.ci360.sas.com *.aimatch.com; img-src 'self' *.aimatch.com; frame-ancestors 'self' design-poc.ciea.sas.us"

Step 3: Log On to the SAS Cloud and SAS App Central

After your SAS environment has been prepared, you receive an email message from SAS with the title “Welcome to the SAS Cloud! Your account is ready.” The next step is to obtain a SAS Profile and log on to the SAS Cloud.

1 Use your browser to navigate to http://cloud.sas.com/appcentral/home.

2 In the left pane of the SAS Login page, enter your tenant administrator credentials, and click Login. If you do not have a profile for SAS App Central, click Create in the right pane.

Note: The email address that you use to log on must match the email address where you received the welcome message.

The SAS App Central home page is displayed.

4

Using SAS App Central, you can perform account administration functions, including adding users, assigning users to roles and environments, and managing email templates.

From the My Applications section of the home page, you can access any applications that are associated with your profile. For example, you might have an entry for SAS Customer Intelligence, which provides access to the features of SAS Customer Intelligence 360.

Step 4: (Optional) Create an Invitation Email

When you add users, you can choose to send them an invitation email. The email welcomes users to the SAS Cloud and provides instructions for logging on. By default, the email is sent using a standard invitation template for your account’s preferred locale.

You can customize the invitation email to include the URL that your users need to log on to SAS Customer Intelligence 360. Alternatively, you might create two invitation emails:

n One email might be sent to users who already have a SAS Profile that they can use to log on to SAS Customer Intelligence 360. That email might contain only the logon URL for SAS Customer Intelligence 360.

n Another email might be sent to users who are new to the SAS Cloud and need both registration instructions for creating their profile and the logon URL for SAS Customer Intelligence 360. In this email, you can remind new users that the email address that they create their profile with must match the email address that the invitation email was sent to.

To create an invitation email:

5

1 On Email Templates tab of SAS App Central, click Message Templates.

2 Click Create Message Template.

3 Complete the fields in the Create Message Template dialog box. If there is an existing template that you want use as a base, select the template from the Template to copy list. When you click Create, your template appears in the table on the Message Templates tab.

6

4 Click the name of template in table to open the editing view.

5 Complete these steps in the editing view:

a Change the template’s description and subject line in the corresponding fields.

b Add body content on the HTML tab or the Text tab.

TIP You might want to include information about role permissions that you set for the user. For more information, see “Step 3: Assign New Users to the Environment” on page 12.

This example text is a recommended HTML template that you can use for new users. You can paste this text into the field on the HTML tab:

<div><a title="SAS - The Power to Know" href="http://www.sas.com"><img src="https://support.sas.com/images/SAS_TPTK_logo.gif" alt="SAS Logo" width="181" height="43"></img></a></div><p> </p><p>Welcome to SAS Customer Intelligence 360! You have been invited to use SAS Customer Intelligence 360 as part of the <em><strong>$ACCOUNT_NAME$</strong></em> account.</p><p> </p><p>Use your SAS Profile to access <a href="https://platform-<region_code>.ci360.sas.com/SASCustomerIntelligenceHome/">SAS Customer Intelligence 360</a>.</p><p> </p><p>If you do not have a SAS Profile, visit <a href="https://cloud.sas.com">https://cloud.sas.com</a> to create one. You must have a SAS Profile to log in to SAS Customer Intelligence 360.</p><p>Information to help you get started is available at <a href="http://www.sas.com/customer-intelligence360-get-started">SAS Customer Intelligence 360 Learning Center</a>. This site provides access to user documentation, tutorials, SAS Communities, and many more learning resources.</p><p> </p><p><strong>Additional Resources</strong></p><ul><li>SAS Technical Support: <a href="http://support.sas.com/ctx/supportform/createForm">http://support.sas.com/ctx/supportform/createForm</a></li><li>SAS Privacy Policy: <a href="http://www.sas.com/en_us/legal/on-demand-privacy.html">http://www.sas.com/en_us/legal/on-demand-privacy.html</a></li></ul>

Note: Customize the link to the environment for SAS Customer Intelligence 360 based on the region of your tenant.

7

Step 5: Manage UsersIf there are existing users in the environment, go to “Synchronize SAS App Central and SAS Customer Intelligence 360 Roles after Migration” on page 12.. Otherwise, continue with step 1.

Step 1: Add Users

Before users can access software in your SAS Cloud environment, they must be added to SAS App Central. Then, you can assign the users to the environment where the SAS software is hosted.

Add Users Manually

1 Ensure that you have a valid email address for every user that you want to add. The email address that you use for the new user must match the email address in the user’s SAS Profile. This is the same email address that the new user uses to log on.

CAUTION! You must have a unique email address for each tenant or environment. For example, if you have two different tenants (a tenant for testing and a tenant for production), you need a separate SAS profile and email address for each tenant. Some email providers enable you to customize your email address with different punctuation or suffixes (for example, myname@email.com might go to the same inbox as my.name@email.com). These variations are valid as unique email addresses.

2 On the Users tab, click Add Users.

3 Complete these steps in the Add Users dialog box:

a Enter email addresses for up to five users.

b (Optional) Select Send invitations if you want invitation emails to be sent immediately. The emails have the subject line “Welcome to the SAS Cloud” and provide instructions for logging on.

TIP You can preview the invitation emails and customize them on the Email Templates tab. You can also send users an email anytime by navigating to the Users tab and clicking .

c Click Add.

8

4 Repeat these steps until you have added all of your users. Next, set up user roles in SAS App Central.

Note: Newly added users will have View access to the Activities, Assets, Creatives, Data Views, Events, Insights, Messages, Segments, Spots, and Tasks pages in SAS Customer Intelligence 360. The SAS administrator assigns the appropriate roles in SAS Customer Intelligence 360 to limit access or to allow Edit access as required. For more information, see “Managing Users” in SAS Cloud: Account Administrator’s Guide.

Upload User Data

If you have a large number of users, you might want to upload the information in a comma-separated values (CSV) file.

1 Create a CSV file with a list of email addresses. If the file contains data other than email addresses, use commas to separate the data elements. Here is an example of a file where each entry includes a last name, a first name, and an email address:

Torres,Juan,Juan.Torres@example.comJones,Mary,Mary.Jones@example.comPatel,Avi,Avi.Patel@example.comMinami,Yuki,Yuki.Minami@example.com

Note: Email addresses must be 32 characters or fewer in length.

2 On the Users tab, click .

9

3 In the Upload Users dialog box, complete these steps:

a In the File field, click Choose File and then navigate to the file that you created in step 1 earlier in this section.

b Enter the column number that contains the email addresses. In the example file in step 1, the email addresses are in column 3 because they are the third value on each line.

c If the first row of the file contains header information that you want to be ignored, select First row is a header.

d Select Send invitations if you want invitation emails to be sent immediately to the new users.

TIP You can send the emails later. For more information, see “Send Invitations to New Users” in SAS Cloud: Account Administrator’s Guide.

Note: All of the uploaded user emails are automatically assigned to the SAS user role in App Central role. Newly added SAS users will have View access to the Activities, Assets, Creatives, Data Views, Events, Insights, Messages, Segments, Spots, and Tasks pages in SAS Customer Intelligence 360. The SAS administrator assigns the appropriate roles in SAS Customer Intelligence 360 to limit access or to allow Edit access as required. For information about assigning additional roles in SAS App Central such as SAS administrator and assigning users to the tenant’s environment, see “Step 2: Set Up Users’ SAS App Central Roles” on page 10.

Step 2: Set Up Users’ SAS App Central Roles

About SAS App Central Roles

Roles determine what users can do in SAS App Central and in your organization’s SAS environments.

The following table identifies which tasks each role can perform in SAS App Central and which parts of the SAS Customer Intelligence 360 user interface the user has View or Edit permissions to.

10

Table 1 SAS App Central Roles

SAS App Central Role Allowed Tasks in SAS App Central

Access to Pages in the SAS Customer Intelligence 360 User Interface

SAS user View the Home page.

From the Home page, access non-administrative SAS applications.

By default, View access to the Activities, Assets, Creatives, Data Views, Events, Insights, Messages, Segments, Spots, and Tasks pages. Administrators must assign Edit permissions for these pages on the User Roles page in SAS Customer Intelligence 360. View and Edit access on all other pages are set by administrators on the User Roles page. For more information, see “List of Roles” in SAS Customer Intelligence 360: User’s Guide.

SAS administrator View the Home page.

From the Home page, access applications in the SAS environment that are used for administration.

View and Edit access to all pages.

Only SAS administrators have access to all admin areas, including the User Roles page, on the General page on the navigation bar.

data administrator View the Home page.

From the Home page, access applications in the SAS environment that are used for data management.

Not applicable. This role applies only to SAS App Central.

account administrator View the Home page.

View account information.

Manage users and send emails to users.

Assign users to environments and roles.

Manage news.

Manage email templates.

Not applicable. This role applies only to SAS App Central.

Modifying SAS App Central Roles for New or Existing Users

By default, all users are assigned to the SAS user role in SAS App Central. To assign a user to an additional SAS App Central role (or to remove a user from a role):

1 On the Users tab, click the user’s email address.

2 In the Roles section of the user’s information page, click Edit.

3 In the Edit Roles dialog box, select or clear the appropriate check boxes to specify roles for the user. To assign the user to all roles, select the check box in the first row.

Note: The data administrator and account administrator roles are NOT applicable to SAS Customer Intelligence 360. Primary tenant administrators might assign the account administrator role to another user in the organization in order to share the responsibility for user management in App Central. For information

11

about modifying an existing data administrator role, see “Synchronize SAS App Central and SAS Customer Intelligence 360 Roles after Migration” on page 12.

4 Click OK.

Note: Users must be given access to one or more SAS environments before they can perform all of the tasks associated with their roles. For more information, see “Step 3: Assign New Users to the Environment” on page 12.

Synchronize SAS App Central and SAS Customer Intelligence 360 Roles after Migration

If you migrated from a release of SAS Customer Intelligence 360 where roles are assigned in SAS App Central to a release where the user interface is used to assign roles for SAS Customer Intelligence 360, it is recommended to change the role for existing users who have been assigned only the Data administrator role in SAS App Central.

If a user has only the Data administrator role, the Align Roles button appears in the Environments pane after you click the email user ID for a user on the Users tab, as shown.

Figure 1 Users Tab

To remove the Align Roles button:

1 On the Users tab, click the user’s email address.

2 In the Roles section of the user’s information page, click Edit.

3 In the Edit Roles dialog box, clear the check box for Data administrator and select the check box for SAS user.

4 Click OK.

Step 3: Assign New Users to the Environment

Assign each user to the SAS Cloud environment.

1 On the Environments tab, click the link for the environment.

Note: If you administer more than more environment, you must manage other tenant environments with the email address that is associated with that tenant.

12

2 On the environment page, click Edit in the Users section.

3 In the Edit Users dialog box, select the email addresses of the users that you want to assign to the environment.

Click OK to add the users to the environment’s user list. Initially, the status of a user is Onboarding. After the user successfully logs on to the software, the status changes to Active.

(Optional) Step 4. Remove Users from the Environment

You might need to remove users from the SAS Cloud environment.

1 On the Environments tab, click the link for the environment.

Note: If you administer more than one environment, you must manage other tenant environments with the email address that is associated with that tenant.

2 On the environment page, click Edit in the Users section.

3 In the Edit Users dialog box, deselect the email addresses of the users that you want to remove from the environment.

Click OK to remove the users from the environment’s user list. It might take up to 15 minutes before the user is removed from the environment.

Requesting Integration with a Data Management Platform

Note: This information is applicable only to SAS 360 Engage users.

13

If you need to use a data management platform (DMP) with SAS Customer Intelligence 360 in order to access the segments provided by the DMP for targeting decisions, you must request a DMP integration through a service ticket. This request is routed to the applicable SAS department to configure the back-end settings in order to integrate with the DMP. This integration requires using the proper credentials, creating a cookie connection between SAS Customer Intelligence 360 and the DMP, and creating a list of available DMP segments that can be viewed by the SAS Customer Intelligence 360 task-targeting user interface. After the DMP is integrated, the DMP segments appear in the task-targeting user interface when you select Customer Profile ð External Segments. The segments can be used in targeting criteria. For example, if your DMP vendor has a segment called Travel Enthusiast, you can now see that segment listed as a possible selection for task targeting. After that task is published with that targeting criteria, every visitor to your website who is a part of that segment (according to the DMP) is targeted with that task. For more information, contact SAS Technical Support at http://support.sas.com/techsup/contact/.

SAS Learning, Training Courses, and Technical Support

These web pages on the SAS Customer Support site provide access to helpful information:

Learning CenterView the Learning Center at http://www.sas.com/en_us/learn/software/customer-intelligence-360.html. The Learning Center provides information about getting started, basic and advanced tutorials, access to the SAS Communities, and links to relevant training courses.

Training CoursesFor training courses, see http://support.sas.com/training/us/paths/index.html and select SAS Customer Intelligence 360 in SAS Solutions. You can also send an email to training@sas.com.

Technical SupportIf you are unable to resolve a problem by using the resources that are listed here, contact SAS Technical Support as described at http://support.sas.com/techsup/contact/. Customers in North America can call 1-800-727-0025. If you are outside of North America and want to contact your local SAS office, click find your local office contact information on the SAS Technical Support page.

SAS® and all other SAS Institute Inc. product or service names are registered trademarks or trademarks of SAS Institute Inc. in the USA and other countries. ® indicates USA registration. Other brand and product names are trademarks of their respective companies. Copyright © 2018, SAS Institute Inc., Cary, NC, USA. All Rights Reserved. August 2018 18.08-P1:cintqsg

14